WO2020049754A1

WO2020049754A1 - Information processing method, information processing program, information processing apparatus, and information processing system

Info

Publication number: WO2020049754A1
Application number: PCT/JP2019/005681
Authority: WO
Inventors: 久利寿帝都
Original assignee: コネクトフリー株式会社
Priority date: 2018-09-05
Filing date: 2019-02-15
Publication date: 2020-03-12
Also published as: TW202027449A; US20210392001A1; JP2022031777A; JPWO2020049754A1; US11902454B2; JP7054559B2; JP2023106509A; EP3849131A4; JP7536346B2; EP3849131A1; US20240129137A1; TW202347986A; JP2024149592A; TWI802749B

Abstract

This information processing method is executed by a processor of an apparatus, and comprises a step (S2) for generating a public key of the apparatus on the basis of a secret key of the apparatus; a step (S3) for generating a hash value on the basis of the public key and a predetermined hash function; and a step (S6) for determining an IP address of the apparatus on the basis of the hash value.

Description

Information processing method, information processing program, information processing apparatus, and information processing system

The present disclosure relates to an information processing method, an information processing program, an information processing device, and an information processing system.

情報 In recent years, the development of information and communication technology has been remarkable, and not only personal computers, smartphones and tablets, but also everything such as automobiles, home appliances, and sensor devices are being connected to communication networks such as the Internet. Thus, an IoT (Internet of Things) society in which trillions of devices on the earth are connected to a communication network is expected to arrive in the near future (see Patent Document 1).

Japanese Patent Publication No. 2016-515328

By the way, as disclosed in Patent Document 1, in the current IoT technology, an Internet service provider (ISP) manages the IP address of each device connected to the Internet. For example, when a predetermined device is connected to the Internet, the ISP assigns an IP address to the predetermined device. Thereafter, the predetermined device can access a web server on the Internet using the IP address assigned by the ISP. As described above, in the case where the device is connected to a communication network such as the Internet, intervention of a business operator that manages an IP address such as an ISP is required, and a user experience or a user's convenience in connecting to the communication network is required. There is room for improvement in terms of improvement.

The present disclosure aims to provide an information processing method, an information processing program, an information processing apparatus, and an information processing system capable of improving a user experience or a user's convenience for connection to a communication network.

An information processing method according to an aspect of the present disclosure is executed by a processor of an apparatus,
Generating a public key of the device based on a secret key of the device;
Generating a hash value based on the public key and a predetermined hash function;
Determining a network address of the device based on the hash value;
including.

The information processing method may further include a step of generating the secret key.

The information processing method may further include a step of transmitting the public key to an external device existing outside the device.

The information processing method may further include a step of determining whether the hash value satisfies a predetermined condition. When the hash value satisfies the predetermined condition, the network address may be determined based on the hash value.

Further, the information processing method may further include a step of generating the secret key.
When the hash value does not satisfy the predetermined condition, generating the secret key until the hash value satisfies the predetermined condition; generating the public key; and generating the hash value. May be repeatedly executed.

The predetermined condition may include a condition associated with the first two digits of the hash value.

The predetermined condition may include a condition associated with the type of the device.

The step of generating the hash value may include the step of generating the hash value based on the public key, a value associated with a predetermined organization, and the predetermined hash function.

The value associated with the predetermined organization may be a value associated with a trademark of the predetermined organization.

The information processing method may further include a step of obtaining an electronic certificate associated with the public key from a certificate authority.

The information processing method may further include a step of transmitting the public key and the electronic certificate to an external device existing outside the device.

The electronic certificate may include information related to the attribute of the device.

The electronic certificate may include attribute information of a user associated with the device.

Also, the electronic certificate is
Attribute information of the device and / or a user associated with the device;
A hash value of the entire attribute information;
May be included.

In addition, a part of the attribute information may be hashed.

Further, a part of the attribute information may be hashed based on a part of the attribute information and a predetermined coefficient.

Further, the information processing method includes:
Receiving a public key of the external device from an external device existing outside the device,
Generating a hash value of the external device based on the public key of the external device and the predetermined hash function;
Determining a network address of the external device based on a hash value of the external device.

The step of receiving the public key of the external device may include the step of receiving a public key of the external device and an electronic certificate associated with the public key. The information processing method may further include a step of determining whether the electronic certificate is valid. When it is determined that the electronic certificate is valid, a hash value of the external device may be generated based on a public key of the external device.

<< The information processing method according to an aspect of the present disclosure is executed by a processor of an apparatus, and includes a step of determining a network address of the apparatus based on a public key of the apparatus.

The information processing method may further include a step of executing communication using the network address of the device without using a server that manages the network address.

The information processing method may be executed in a network layer of the OSI reference model.

Also, an information processing program for causing a computer to execute the information processing method is provided. Further, a computer-readable storage medium storing the information processing program is provided.

The information processing apparatus according to an embodiment of the present disclosure includes at least one processor and a memory that stores computer-readable instructions. The information processing device is configured to execute the information processing method when the computer readable instruction is executed by the processor.

An information processing system according to an embodiment of the present disclosure includes a first device and a second device communicably connected to the first device.
The first device comprises:
Generating a first public key of the first device based on a first secret key of the first device;
Generating a first hash value based on the first public key and a predetermined hash function;
Determining a first network address of the first device based on the first hash value;
Transmitting the first public key to the second device;
The second device includes:
Generating a second public key of the second device based on a second secret key of the second device;
Generating a second hash value based on the second public key and the predetermined hash function;
Determining a second network address of the second device based on the second hash value;
Transmitting the second public key to the first device;
The first device comprises:
Receiving the second public key from the second device;
Generating the second hash value based on the second public key and the predetermined hash function;
The second network address is determined based on the second hash value.
The second device includes:
Receiving the first public key from the first device;
Generating the first hash value based on the first public key and the predetermined hash function;
The first network address is determined based on the first hash value.

Further, the first device includes:
Sending the first public key to a certificate authority,
Obtaining a first digital certificate associated with the first public key from the certificate authority;
The first electronic certificate and the first public key may be transmitted to the second device.
The second device includes:
Transmitting the second public key to the certificate authority or another certificate authority,
Obtaining a second digital certificate associated with the second public key from the certificate authority or the another certificate authority,
The second electronic certificate and the second public key may be transmitted to the first device.
The first device comprises:
Receiving the second public key and the second digital certificate from the second device;
It may be determined whether the second electronic certificate is valid.
The second device includes:
Receiving the first public key and the first digital certificate from the first device;
It may be determined whether the first digital certificate is valid.

According to the present disclosure, it is possible to provide an information processing method, an information processing program, an information processing apparatus, and an information processing system capable of improving a user experience or a user's convenience for connection to a communication network.

1 is a diagram illustrating an example of a hardware configuration of an information processing apparatus according to an embodiment (hereinafter, referred to as an embodiment) of the present invention. 13 is a flowchart illustrating an example of a process for determining an IP address of an information processing device. FIG. 2 is a diagram illustrating an information processing apparatus and a server on the Internet. FIG. 1 is a diagram illustrating an information processing system including two information processing apparatuses. 9 is a flowchart illustrating an example of a process for determining an IP address of an external device. 9 is a flowchart illustrating an example of a process of determining the validity of an electronic certificate transmitted from an external device. FIG. 2 is a diagram illustrating an information processing system including four information processing apparatuses. FIG. 7 is a diagram illustrating an example of an electronic certificate before and after a part of user attribute information is hashed.

Hereinafter, the present embodiment will be described with reference to the drawings. First, a hardware configuration of an information processing apparatus 2 according to an embodiment of the present invention (hereinafter, simply referred to as “the present embodiment”) will be described with reference to FIG.

FIG. 1 is a diagram illustrating an example of a hardware configuration of the information processing apparatus 2 according to the present embodiment. As shown in FIG. 1, the information processing device 2 (hereinafter, simply referred to as “device 2”) includes a control unit 20, a storage device 23, a network interface 25, a display unit 26, and an input operation unit 27. Prepare. These are communicably connected to each other via a bus 29.

The device 2 may be, for example, a personal computer, a smartphone, a tablet, or a wearable device (for example, a smart watch, AR glass, or the like) attached to a user's body (for example, an arm or a head). The device 2 may be a control device installed in a smart home appliance, a connected car, a factory, or the like. As described above, the type of the device 2 includes all objects that are connected to a communication network such as the Internet using an IP address (an example of a network address) and that include a processor and a memory. In the present embodiment, the device 2 includes the display unit 26 and the input operation unit 27, but these are not essential components of the device 2.

The control unit 20 is configured to control the operation of the device 2, and includes a memory and a processor. The memory is configured to store computer readable instructions (eg, an information processing program). For example, the memory may include a ROM (Read Only Memory) storing various programs and the like, a RAM (Random Access Memory) having a plurality of work areas storing various programs executed by the processor, and the like. . Further, the memory may be constituted by a flash memory or the like. The processor is, for example, a CPU, an MPU (Micro Processing).
Unit) and at least one of a GPU (Graphics Processing Unit). The CPU may be configured by a plurality of CPU cores. The GPU may be configured by a plurality of GPU cores. The processor may be configured to develop a program specified from various programs incorporated in the storage device 23 or the ROM on the RAM, and to execute various processes in cooperation with the RAM. In particular, when the processor executes the information processing program stored in the memory, the device 2 is configured to execute the information processing method according to the present embodiment.

The storage device 23 is, for example, a storage device (storage) such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), or a flash memory, and is configured to store programs and various data. The information processing program according to the present embodiment transmitted from a server on the Internet may be stored in the storage device 23.

The network interface 25 is configured to connect the device 2 to a communication network. Specifically, the network interface 25 may include various wired connection terminals for communicating with an external device such as a server via a communication network. The network interface 25 may include various processing circuits and an antenna for communicating with a wireless router or a wireless base station. The wireless communication standard is, for example, Wi-Fi (registered trademark), Bluetooth (registered trademark), ZigBee (registered trademark), LPWA, or a fifth generation mobile communication system (5G). Further, the communication network includes at least one of a local area network (LAN), a wide area network (WAN), a radio access network (RAN), and the Internet.

The display unit 26 may be a display device such as a liquid crystal display or an organic EL display, or may be a transmissive or non-transmissive head mounted display mounted on the operator's head. Further, the display unit 26 may be a projector device that projects an image on a screen.

The input operation unit 27 is configured to receive an input operation of a user who operates the device 2 and generate an instruction signal corresponding to the input operation. The input operation unit 27 is, for example, a touch panel arranged on the display unit 26, operation buttons attached to a housing, a mouse and / or a keyboard, and the like. After the instruction signal generated by the input operation unit 27 is transmitted to the control unit 20 via the bus 29, the control unit 20 performs a predetermined operation according to the instruction signal. The display unit 26 and the input operation unit 27 may be connected to the device 2 via an input / output interface such as a USB.

Next, an information processing method according to the present embodiment will be described below with reference to FIG. FIG. 2 is a flowchart illustrating an example of a process for determining an IP address (for example, a global IP address) of the device 2. As shown in FIG. 2, in step S1, the control unit 20 of the device 2 generates a secret key of the device 2 using a random number generator. Here, the random number generator may be realized by an OS program of the device 2 or may be realized as a hardware configuration (a logic circuit or the like) of the device 2. The size of the generated secret key is, for example, 512 bits.

Next, in step S2, the control unit 20 generates a public key of the device 2 based on the generated secret key and a predetermined encryption algorithm. Here, the predetermined encryption algorithm is, for example, an elliptic curve encryption algorithm. The size of the generated public key is, for example, 256 bits.

Next, in step S3, the control unit 20 generates a hash value based on the generated public key and a predetermined hash function. Here, the predetermined hash function is a cryptographic hash function, for example, BLAKE is used. The size of the generated hash value is, for example, 256 bits.

The control unit 20 may generate a hash value based on the generated public key, a value associated with a predetermined organization, and a predetermined hash function in step S3. Here, an example of the value associated with the predetermined organization is a value associated with the trademark of the predetermined organization. For example, when a predetermined organization uses the trademark X (for example, “connectFree”), the value of the trademark X may be used when generating the hash value. In this case, it is possible to prevent a third party other than the predetermined organization from creating an information processing program for executing the information processing method according to the present embodiment without permission of the predetermined organization.

Next, the control unit 20 determines whether or not the generated hash value satisfies the condition associated with the first two digits (first and second digits) of the hash value displayed in hexadecimal. A determination is made (step S4). At this point, if the size of the hash value is 256 bits, the hash value is represented by 64 hexadecimal digits. For example, when the first two digits of the hash value represented by 64 digits are “FC” (that is, hash value = FC...), The control unit 20 determines that the hash value is equal to the determination condition in step S4. May be determined to be satisfied. If the determination condition in step S4 is YES, the process proceeds to step S5. On the other hand, if the determination condition in step S4 is NO, the process proceeds to step S1. That is, the processing of steps S1 to S3 is repeatedly performed until the determination condition of step S4 is satisfied.

Next, in step S5, the control unit 20 determines whether the hash value satisfies a condition associated with the type of the device 2 (step S5). At this point, it is assumed that the type of the device 2 associated with the IP address can be specified according to the values of the third and fourth digits from the beginning of the IP address displayed in hexadecimal. For example, it is assumed that the values of the third and fourth digits from the head of the IP address and the type of the device have the following relationship.

Here, if the third and fourth digit values of the hash value represented by hexadecimal numbers match the third and fourth digit values from the beginning of the IP address corresponding to the type of the device 2, The determination condition of S5 is satisfied. For example, assume that the type of the device 2 is a personal computer. In this case, since the values of the third and fourth digits from the beginning of the IP address of the device 2 are “00”, the values of the third and fourth digits from the beginning of the hash value displayed in hexadecimal are “ If “00” (that is, hash value = FC00...), The determination condition of step S5 is satisfied. On the other hand, if the values of the third and fourth digits from the top of the hash value are “11” (that is, hash value = FC11...), The determination condition of step S5 is not satisfied. If the determination condition in step S5 is YES, the process proceeds to step S6. On the other hand, if the determination condition in step S5 is NO, the process proceeds to step S1. That is, the processing of steps S1 to S3 is repeatedly executed until the determination condition of step S5 is satisfied. Note that a configuration in which step S5 is omitted may be adopted.

Next, the control unit 20 determines the IP address of the device 2 based on the hash value that satisfies the determination conditions of steps S4 and S5 (step S6). For example, when the size of the hash value is 256 bits and the IP address (128 bits) corresponding to IPv6 is used as the IP address of the device 2, the control unit 20 sets the first half of the 64-digit hash value to 32 bits. The digit hash value may be determined as the IP address of the device 2. When the size of the hash value is 128 bits and the IP address (128 bits) corresponding to IPv6 is used as the IP address of the device 2, the control unit 20 converts all values of the 32-digit hash value into The IP address of the device 2 may be determined. Furthermore, when the size of the hash value is 256 bits and the IP address (32 bits) corresponding to IPv4 is used as the IP address of the device 2, the control unit 20 sets the first half of the 64-digit hash value to 8 bits. The digit hash value may be determined as the IP address of the device 2.

Note that after the process of step S6, a step of determining whether the determined IP address of the device 2 is the same as the IP address of another device may be provided. Specifically, after the processing in step S6, the device 2 transmits information on the IP address of the device 2 to the management server that manages the IP address via the communication network. The management server determines whether the IP address transmitted from the device 2 overlaps with one of the IP addresses included in the IP address management table stored in its own storage device. Here, if the IP address of the device 2 overlaps with one of the IP addresses included in the IP address management table, the management server may send a message to the device 2 to reject the registration of the IP address. Good. In this case, the device 2 transmits the information on the IP address determined again after executing the processing of steps S1 to S6 again to the management server. On the other hand, if the IP address of the device 2 does not overlap with any of the IP addresses included in the IP address management table, the management server transmits a message to the effect that the registration of the IP address is permitted to the device 2. Is also good.

Next, in step S7, the control unit 20 obtains an electronic certificate associated with the generated public key from a certificate authority of a predetermined organization. That is, the user of the device 2 registers the public key with the certificate authority and obtains an electronic certificate related to the registered public key from the certificate authority. More specifically, the control unit 20 transmits a request for issuing a public key and an electronic certificate (certificate signature request) to a server of a certificate authority via a communication network. Next, the server of the certification authority registers the public key and issues an electronic certificate associated with the public key in response to the received request for issuing the electronic certificate. Then, the server of the certificate authority transmits the electronic certificate to the device 2 via the communication network.

Note that the certificate authority of the predetermined organization may be an intermediate certificate authority of the predetermined organization. Further, when acquiring an electronic certificate related to a public key from a certificate authority, payment of a predetermined fee may be required.

According to the present embodiment, an IP address unique to the device 2 is determined based on the public key of the device 2. Thus, the device 2 can be connected to a communication network such as the Internet using the IP address determined by the device 2 itself. In particular, the device 2 can connect to the Internet using an IP address determined by the device 2 itself without using a service provider (server) that manages a global IP address such as an ISP. At this point, as shown in FIG. 3, the user U operating the device 2 uses the IP address determined by the device 2 itself to perform predetermined routing via the wireless LAN router 3 on the Internet 4. The web server 6 can be accessed. Further, the device 2 can directly communicate with an external device using an IP address determined by the device 2 itself without using a server (for example, a DHCP server) that manages a private IP address (for details, See below).

Therefore, it is possible to provide the information processing method and the information processing apparatus 2 capable of improving the user experience or the convenience of the user for connection to a communication network such as the Internet.

According to the present embodiment, a hash value that satisfies the conditions of steps S4 and S5 can be generated. That is, it is possible to generate an IP address associated with a hash value that satisfies the conditions of steps S4 and S5.

Specifically, the first two digits of the hash value represented by the hexadecimal number can be a fixed value (for example, hash value = FC...). That is, the first two digits of the IP address can be set to a fixed value (for example, IP address = FC...). Therefore, a third party can determine whether the IP address of the device 2 is an IP address determined by the device 2 itself.

{Furthermore, in the present embodiment, a hash value corresponding to the type of the device 2 can be generated. That is, an IP address corresponding to the type of the device 2 can be generated. Therefore, a third party can specify the type of the device 2 based on the IP address of the device 2.

Further, in the present embodiment, since the hash value is repeatedly generated until the determination conditions of steps S4 and S5 are satisfied, it is possible to surely generate the IP address associated with the hash value satisfying the conditions of steps S4 and S5. it can.

According to the present embodiment, the public key is directly authenticated by the certificate authority through the acquisition of the electronic certificate, and the IP address determined based on the public key is also indirectly authenticated by the certificate authority. In this way, the device 2 can connect to a communication network such as the Internet using the IP address indirectly authenticated by the certificate authority.

In the description of the present embodiment, the secret key of the device 2 is generated using the random number generator of the device 2. The secret key of the device 2 is provided by an external device communicably connected to the device 2. You may. The order of each step shown in FIG. 2 is not particularly limited. For example, the process of step S6 may be performed after the process of step S7.

The electronic certificate associated with the public key may include information (attribute information) related to the attribute of the device 2. The attribute information of the device 2 may include, for example, at least one of version information of an OS program of the device 2 and information on a serial number of hardware (for example, a processor or a storage device) constituting the device 2. Further, the attribute information of the device 2 included in the electronic certificate may be encrypted by a hash function or the like. In this case, when transmitting the request for issuing the public key and the electronic certificate (certificate signature request), the device 2 may transmit the attribute information of the device 2 to the server of the certificate authority. As described above, since the attribute information of the device 2 is included in the electronic certificate, it is authenticated that the electronic certificate has been issued according to the request of the device 2. For this reason, it is suitably prevented that a device other than the device 2 uses the public key and the electronic certificate of the device 2.

The electronic certificate may also include attribute information of a user associated with the device 2 (for example, a user who owns the device 2). For example, an example of the user's attribute information is the user's name, identification number, contact information, age, gender, address, or credit card information. As described above, since the attribute information of the user is included in the electronic certificate, a third party other than the user is preferably prevented from using the public key of the apparatus 2 and the electronic certificate. Further, when the device 2 transmits an electronic certificate including user attribute information to the WEB server, the WEB server can check the user attribute information included in the electronic certificate. Therefore, the user of the device 2 can use an online service (such as an EC site) provided by the WEB server without registering the user information or the like. That is, the user of the device 2 can be released from the trouble of managing the login information (login ID and login password) of each online service, so that a rich online experience can be provided to the user.

(4) The hash value of the attribute information of the device 2 and / or the attribute information of the user (hereinafter, may be simply referred to as “attribute information”) described in the electronic certificate may be included in the electronic certificate. The hash value is generated based on the attribute information and the cryptographic hash function. In this case, if the attribute information described in the electronic certificate is falsified by a third party, the hash value changes, so that the falsification of the attribute information can be detected based on the hash value. For example, when the device 2 transmits an electronic certificate to an external device, the external device calculates the hash value of the attribute information of the electronic certificate so that the calculated hash value matches the hash value indicated in the electronic certificate. It is determined whether or not to do. Here, if the calculated hash value matches the hash value indicated in the digital certificate, the external device determines that the attribute information of the digital certificate has not been falsified. On the other hand, if the two do not match, the external device determines that the attribute information of the electronic certificate has been falsified.

ハッシュ Also, the hash value of all the contents described in the electronic certificate may be included in the electronic certificate. Similarly, in this case, if a part of the content described in the digital certificate is tampered with by a third party, the hash value changes, so the description content of the digital certificate is changed based on the hash value. It is possible to detect tampering by three parties.

As described above, the electronic certificate includes the attribute information of the device 2 and / or the attribute information of the user. In this case, all the attribute information described in the electronic certificate may be transmitted to the external device, or some of the attribute information described in the electronic certificate may not be transmitted to the external device. That is, some attribute information described in the electronic certificate may be hashed by the hash function. For example, as shown in FIG. 8, the user can hash an address, credit card information, and the like in the user attribute information 40 described in the electronic certificate 8 through an input operation on the device 2. As described above, the external device that has received the electronic certificate 8 from the device 2 cannot specify the address and the credit card information in the user attribute information 40 described in the electronic certificate 8, but the user other than the address and the credit card information The attribute information 40 can be specified.

Also, as shown in FIG. 8, the hash values of all the attribute information when all the attribute information are in the display state are all the hash values when some of the attribute information is in the non-display (hash) state. Matches the hash value of the attribute information. Similarly, the hash value of all the description contents described in the electronic certificate when all the attribute information is in the display state is the same as the hash value when some of the attribute information is in the non-display (hash) state. It matches the hash value of all the contents described in the electronic certificate. In other words, even if a part of the attribute information is hashed, the hash value of all the attribute information or the hash value of all the description contents described in the digital certificate does not change. Tampering with the electronic certificate can be easily detected.

(4) The non-display (hashing) of some attribute information may be set in advance by the user or may be changeable in response to a request from an external device. It is assumed that the original attribute information is grasped based on the hash value of the attribute information by referring to the database indicating the relationship between the hash value and the original information. In order to prevent such a situation, the original attribute information may be hashed based on a predetermined coefficient and the original attribute information. In this case, the predetermined coefficient may be a constant, or may be a variable that changes based on predetermined information (for example, date information of an electronic certificate).

Next, the information processing system 30 according to the present embodiment will be described below mainly with reference to FIGS. FIG. 4 is a diagram illustrating an information processing system 30 including an information processing device 2A (hereinafter, simply referred to as “device 2A”) and an information processing device 2B (hereinafter, simply referred to as “device 2B”). FIG. 5 is a flowchart illustrating an example of a process for determining an IP address of an external device.

In the information processing system 30 of the present embodiment, for simplicity of description, the number of information processing devices that are communicably connected to each other is two. The number may be three or more. Each of the

devices

2A and 2B has the hardware configuration of the device 2 shown in FIG.

{Furthermore, it is assumed that each of the

devices

2A and 2B has already executed the processing for determining the IP address shown in FIG. That is, it is assumed that the device 2A has already executed the process of determining the IP address of the device 2A. Therefore, as shown in FIG. 4, the device 2A has already generated the public key 7A associated with the IP address of the device 2A, and has already issued the electronic certificate 8A associated with the public key 7A from the certificate authority. It is assumed that it has been acquired. Similarly, it is assumed that the device 2B has already executed the process of determining the IP address of the device 2B. Therefore, as shown in FIG. 4, the device 2B has already generated the public key 7B associated with the IP address of the device 2B, and has already issued the digital certificate 8B associated with the public key 7B from the certificate authority. It is assumed that it has been acquired.

As shown in FIG. 5, in step S10, the device 2A (specifically, the control unit 20 of the device 2A) sends a public key 7A and an electronic certificate 8A associated with the public key 7A to the outside of the device 2A. (Broadcast). Thereafter, the device 2B existing near the device 2A receives the public key 7A and the electronic certificate 8A broadcast from the device 2A. In step S11, the device 2B (specifically, the control unit 20 of the device 2B) transmits (broadcasts) the public key 7B and the electronic certificate 8B associated with the public key 7B to the outside of the device 2B. I do. Thereafter, the device 2A receives the public key 7B and the electronic certificate 8B broadcast from the device 2B. Note that the process of step S11 may be performed simultaneously with the process of step S10, or may be performed before the process of step S10.

Next, in step S12, the device 2B determines whether the digital certificate 8A broadcast from the device 2A is valid. Here, the process of determining the validity of the electronic certificate 8A (that is, the process of step S12) will be described below with reference to FIG.

As shown in FIG. 6, in step S20, the device 2B determines the integrity of the electronic certificate 8A. Specifically, the device 2B checks the owner information of the electronic certificate 8A, the issuer information of the electronic certificate 8A, and the digital signature of the issuer. Next, in step S21, the device 2B determines the expiration date of the electronic certificate 8A. Thereafter, in step S22, the device 2B determines the reliability of the issuer of the electronic certificate 8A. In particular, when the certificate authority that has issued the digital certificate 8A is an intermediate certificate authority, the device 2B specifies the root certificate authority of the intermediate certificate authority that has issued the digital certificate 8A, and determines that the specified root certificate authority is Determine if you can trust. For example, if the specified root certificate authority is included in the information on a plurality of root certificate authorities stored in the memory of the device 2B, it is determined that the issuer of the electronic certificate 8A is reliable.

Returning to FIG. 5, when determining that the electronic certificate 8A is valid, the device 2B generates a hash value based on the public key 7A and a predetermined hash function (step S13). Here, the predetermined hash function is a cryptographic hash function such as BLAKE as described above. Further, in the present embodiment, it is assumed that the hash function used by the device 2B and the hash function used by the device 2A are the same.

Next, in step S14, the device 2B determines the IP address of the device 2A based on the generated hash value. For example, as described above, when the size of the hash value is 256 bits and the IP address (128 bits) corresponding to IPv6 is used as the IP address of the device 2A, the device 2B generates the 64-digit hash value. Of the first half may be determined as the IP address of the device 2A.

On the other hand, in step S15, the device 2A determines whether the electronic certificate 8B broadcast from the device 2B is valid. The specific contents of the processing in step S15 are as shown in FIG. Next, when determining that the electronic certificate 8B is valid, the device 2A generates a hash value based on the public key 7B and a predetermined hash function (Step S16). Further, as described above, the hash function used by the device 2A is the same as the hash function used by the device 2B.

Thereafter, in step S17, the device 2A determines the IP address of the device 2B based on the generated hash value. Similarly to the processing in step S14, when the size of the hash value is 256 bits and the IP address (128 bits) corresponding to IPv6 is used as the IP address of the device 2B, the device 2A uses the 64-digit hash value. May be determined as the IP address of the device 2B.

As described above, the device 2A can know the IP addresses of the

devices

2A and 2B, and the device 2B can know the IP addresses of the

devices

2A and 2B. Therefore, the

devices

2A and 2B can be directly connected to each other without using a server that manages an IP address (that is, P2P communication with the

devices

2A and 2B without a server can be realized). In particular, since there is no need to connect the

devices

2A and 2B via a virtual private network (VPN) server, the power consumption required for direct connection between the

devices

2A and 2B can be significantly reduced. Also, even when three or more devices are directly connected, there is no need to relay a VPN server, so that the power consumption required for the direct connection between three or more devices can be significantly reduced.

For example, since the device 2A can transmit a message to the device 2B without passing through a mail server or the like, it is possible to avoid a situation where the message of the device 2A is grasped by a third party (for example, a server administrator or the like). It becomes possible. Further, the device 2A can transmit image data indicating the screen screen of the device 2A to the device 2B without going through the VPN server. On the other hand, the device 2B can transmit an operation signal for operating the screen screen of the device 2A to the device 2A without going through the VPN server. Thus, the user of the device 2B can remotely operate the device 2A. Further, the device 2A and the device 2B can share an electronic file with each other without going through a file exchange server. Therefore, it is possible to avoid a situation where the shared electronic file is grasped by a third party.

When the device 2A transmits a message to the device 2B (or when the device 2B transmits a message to the device 2A), the transmission message (transmission packet) may be encrypted. For example, the transmission message may be encrypted with a common key generated based on the public key 7A of the device 2A and the public key 7B of the device 2B. Further, the common key may be changed each time a session between the device 2A and the device 2B is established. Thus, it is possible to realize secure communication between the device 2A and the device 2B.

According to the present embodiment, when the electronic certificate transmitted from the external device is determined to be valid, the hash value of the external device is generated based on the public key of the external device. Thereafter, the IP address of the external device is determined based on the hash value of the external device (here, the device 2B is an external device when viewed from the device 2A, while the device 2A is determined when viewed from the device 2B). Is an external device.). In this manner, the device 2A can confirm that the received public key 7B is the public key of the device 2B. Further, the device 2A can confirm that the IP address generated based on the public key 7B is the IP address of the device 2B. Therefore, the device 2A can reliably acquire the IP address of the device 2B, and can reliably communicate with the device 2B using the IP address of the device 2B.

On the other hand, the device 2B can confirm that the received public key 7A is the public key of the device 2A. Further, the device 2B can confirm that the IP address generated based on the public key 7A is the IP address of the device 2A. Therefore, the device 2B can reliably acquire the IP address of the device 2A and can reliably communicate with the device 2A using the IP address of the device 2A.

As described above, the information processing system according to the present embodiment may include three or more information processing devices. For example, as shown in FIG. 7, it is assumed that the information processing system 30A has four information processing devices 2A to 2D (hereinafter, simply referred to as “devices 2A to 2D”). Here, each of the devices 2A to 2D has the hardware configuration of the device 2 shown in FIG. In this case, each of the devices 2A to 2D executes each processing executed by the

device

2A or 2B shown in FIG.

At this point, the device 2A broadcasts the public key and the electronic certificate of the device 2A to the outside, and receives the public key and the electronic certificate from each of the devices 2B to 2D existing near the device 2A. The device 2B broadcasts the public key and the electronic certificate of the device 2B to the outside, and receives the public key and the electronic certificate from each of the

devices

2A, 2C, and 2D. The device 2C broadcasts the public key and the electronic certificate of the device 2C to the outside, and receives the public key and the electronic certificate from each of the

devices

2A, 2B, and 2D. The device 2D broadcasts the public key and the electronic certificate of the device 2D to the outside, and receives the public key and the electronic certificate from each of the devices 2A to 2C.

(4) Thereafter, the device 2A determines the IP addresses of the devices 2B to 2D. The device 2B determines the IP addresses of the

devices

2A, 2C, and 2D. The device 2C determines the IP addresses of the

devices

2A, 2B, and 2D. The device 2D determines the IP addresses of the devices 2A to 2C. Thus, each of the devices 2A-2D can be directly connected to three external devices using the IP addresses of the devices 2A-2D. In other words, a mesh network can be configured by the devices 2A to 2D. Further, the connection of the devices 2A to 2D may be through a predetermined routing in a communication network. The devices 2A to 2D can be connected to each other to form an optimal path.

Further, in the information processing system 30A shown in FIG. 7, since each of the devices 2A to 2D uses the same hash function, a mesh network is configured by the devices 2A to 2D, but the present embodiment is not limited to this. Not something.

For example, while the

devices

2A and 2B use the first hash function, the

devices

2C and 2D may use a second hash function different from the first hash function. In this case, the

devices

2A and 2B are communicably connected to each other, and the

devices

2C and 2D are communicably connected to each other. On the other hand, the

devices

2A and 2B are not communicably connected to the

devices

2C and 2D. Thus, two communication network groups can be constructed in the information processing system 30A by using two different hash functions.

In order to implement the device 2 according to the present embodiment by software, an information processing program may be pre-installed in the storage device 23 or the ROM. Alternatively, the information processing program includes a magnetic disk (for example, HDD, floppy disk), an optical disk (for example, CD-ROM, DVD-ROM, Blu-ray (registered trademark) disk), a magneto-optical disk (for example, MO), and a flash. It may be stored in a computer-readable storage medium such as a memory (for example, an SD card, a USB memory, or an SSD). In this case, an information processing program stored in a computer-readable storage medium may be incorporated in the storage device 23. Further, after the information processing program incorporated in the storage device 23 is loaded on the RAM, the processor may execute the information processing program loaded on the RAM. Thus, the information processing method according to the present embodiment is executed by the device 2.

The information processing program may be stored in a storage medium (for example, HDD) of a server on a communication network such as the Internet. In this case, the information processing program may be downloaded from the server via the network interface 25. In this case, similarly, the downloaded information processing program may be incorporated in the storage device 23.

The information processing program (information processing method) according to the present embodiment is executed by a network layer in an OSI (Open \ Systems \ Interconnection) reference model. Therefore, secure communication can be realized in the transport layer, session layer, presentation layer, and application layer of the OSI reference model, and the existing application programs and physical infrastructure can be applied as they are.

Although the embodiments of the present invention have been described above, the technical scope of the present invention should not be construed as being limited by the description of the embodiments. This embodiment is an example, and it will be understood by those skilled in the art that various embodiments can be modified within the scope of the invention described in the claims. The technical scope of the present invention should be determined based on the scope of the invention described in the claims and the equivalents thereof.

For example, in the process of step S7 shown in FIG. 2, the device 2 may acquire an electronic certificate associated with the public key of the device 2 from certificate authorities of a plurality of organizations. Further, the electronic certificate may include information related to the attribute of the organization of the certificate authority. For example, when the electronic certificate is issued from the certificate authority of organization X, the electronic certificate may include information related to the attribute of organization X.

As shown in FIG. 4, the device 2A obtains a plurality of digital certificates 8A from certificate authorities of a plurality of different organizations, and the device 2B obtains a plurality of digital certificates from certificate authorities of a plurality of different organizations. Letter 8B is obtained. In this case, the device 2A transmits the public key 7A and the plurality of digital certificates 8A to the device 2B in step S10. Further, the device 2B transmits the public key 7B and the plurality of digital certificates 8B to the device 2A in step S11. Further, in step S12, after determining whether each of the plurality of digital certificates 8A is valid, at step S12, at least one of the organizations of the plurality of certificate authorities that issued the plurality of digital certificates 8A determines It may be determined whether it is included in the organization list indicating the organizations of the plurality of certificate authorities stored in the memory of the device 2B. Specifically, the device 2B determines at least one of the organizations of the plurality of certificate authorities that issued the plurality of digital certificates 8A based on information related to the attribute of the organization included in the digital certificate 8A and the organization list. It may be determined whether or not one is included in the organization list. The device 2B may execute the processing of steps S13 and S14 when at least one of the organizations of the plurality of certificate authorities that issued the plurality of digital certificates 8A is included in the organization list.

Similarly, the device 2A determines in step S15 whether each of the plurality of digital certificates 8B is valid, and then determines at least one of the organizations of the plurality of certificate authorities that issued the plurality of digital certificates 8B. It may be determined whether or not one is included in the organization list indicating a plurality of organizations stored in the memory of the device 2A. Specifically, the device 2A determines at least one of the organizations of the plurality of certificate authorities that issued the plurality of digital certificates 8B based on the information related to the attribute of the organization included in the electronic certificate 8B and the organization list. It may be determined whether one is included in the organization list. The device 2A may execute the processing of steps S16 and S17 when at least one of the plurality of organizations that issued the plurality of digital certificates 8B is included in the organization list.

As described above, the organization that has issued the electronic certificate of the public key 7A is included in the organization list stored in the device 2B, and the organization that has issued the electronic certificate of the public key 7B is included in the organization list stored in the device 2A. If included, device 2A and device 2B may be directly connected to each other. That is, it is possible to select a communication partner according to the condition related to the organization that has issued the electronic certificate, and to construct a plurality of communication network groups in the information processing system.

Further, in the above example, the

devices

2A and 2B have acquired a plurality of digital certificates. However, even when the

devices

2A and 2B have acquired a single digital certificate, the determination related to the organization that issued the digital certificate has been performed. Processing related to the condition may be applied. For example, when the organization of the certificate authority that issued the digital certificate of the device 2A and the organization of the certificate authority that issued the digital certificate of the device 2B are different from each other, the processes of steps S13 and S14 (steps S16 and S17) are not performed. It need not be executed.

In the present embodiment, an IP address that is a network address compatible with the Internet protocol is described as an example of the network address of the

devices

2A and 2B, but the network address is not limited to the IP address. For example, the network addresses of the

devices

2A and 2B may be network addresses corresponding to a predetermined communication protocol other than the Internet protocol.

In this application, the contents disclosed in Japanese Patent Application No. 2018-166429 filed on September 5, 2018 are appropriately incorporated.

Claims

An information processing method executed by a processor of the device,
Generating a public key of the device based on a secret key of the device;
Generating a hash value based on the public key and a predetermined hash function;
Determining a network address of the device based on the hash value;
An information processing method, including:
2. The information processing method according to claim 1, further comprising: generating the secret key.
The information processing method according to claim 1 or 2, further comprising: transmitting the public key to an external device existing outside the device.
Determining whether the hash value satisfies a predetermined condition,
The information processing method according to any one of claims 1 to 3, wherein the network address is determined based on the hash value when the hash value satisfies the predetermined condition.
Generating the secret key,
When the hash value does not satisfy the predetermined condition, generating the secret key until the hash value satisfies the predetermined condition; generating the public key; and generating the hash value. 5. The information processing method according to claim 4, wherein is repeatedly executed.
6. The information processing method according to claim 4, wherein the predetermined condition includes a condition associated with a leading two-digit value of the hash value. 7.
7. The information processing method according to claim 4, wherein the predetermined condition includes a condition associated with the type of the device.
The step of generating the hash value includes:
The information processing method according to claim 1, further comprising: generating the hash value based on the public key, a value associated with a predetermined organization, and the predetermined hash function. .
The information processing method according to claim 8, wherein the value associated with the predetermined organization is a value associated with a trademark of the predetermined organization.
10. The information processing method according to claim 1, further comprising: acquiring an electronic certificate associated with the public key from a certificate authority. 10.
The information processing method according to claim 10, further comprising: transmitting the public key and the electronic certificate to an external device existing outside the device.
12. The information processing method according to claim 10, wherein the electronic certificate includes attribute information relating to an attribute of the device.
12. The information processing method according to claim 10, wherein the electronic certificate includes attribute information of a user associated with the device.
The electronic certificate is
Attribute information of the device and / or a user associated with the device;
A hash value of the entire attribute information;
The information processing method according to claim 10, comprising:
15. The information processing method according to claim 14, wherein a part of the attribute information is hashed.
16. The information processing method according to claim 15, wherein a part of the attribute information is hashed based on a part of the attribute information and a predetermined coefficient.
Receiving a public key of the external device from an external device existing outside the device,
Generating a hash value of the external device based on the public key of the external device and the predetermined hash function;
17. The information processing method according to claim 1, further comprising: determining a network address of the external device based on a hash value of the external device.
Receiving the public key of the external device,
Including receiving a public key of the external device and an electronic certificate associated with the public key,
The information processing method further includes a step of determining whether the digital certificate is valid,
18. The information processing method according to claim 17, wherein when the electronic certificate is determined to be valid, a hash value of the external device is generated based on a public key of the external device.
An information processing method executed by a processor of the device,
Determining a network address of the device based on a public key of the device,
Information processing method.
20. The information processing method according to claim 1, further comprising: performing communication using the network address of the device without using a server that manages the network address.
21. The information processing method according to claim 1, wherein the information processing method is executed in a network layer of an OSI reference model.
An information processing program for causing a computer to execute the information processing method according to any one of claims 1 to 21.
A computer-readable storage medium storing the information processing program according to claim 22.
At least one processor,
A memory for storing computer readable instructions, and an information processing apparatus comprising:
The information processing apparatus, wherein the information processing apparatus is configured to execute the information processing method according to any one of claims 1 to 23 when the computer readable instruction is executed by the processor. .
An information processing system including a first device and a second device communicably connected to the first device,
The first device comprises:
Generating a first public key of the first device based on a first secret key of the first device;
Generating a first hash value based on the first public key and a predetermined hash function;
Determining a first network address of the first device based on the first hash value;
Transmitting the first public key to the second device;
The second device includes:
Generating a second public key of the second device based on a second secret key of the second device;
Generating a second hash value based on the second public key and the predetermined hash function;
Determining a second network address of the second device based on the second hash value;
Transmitting the second public key to the first device;
The first device comprises:
Receiving the second public key from the second device;
Generating the second hash value based on the second public key and the predetermined hash function;
Determining the second network address based on the second hash value;
The second device includes:
Receiving the first public key from the first device;
Generating the first hash value based on the first public key and the predetermined hash function;
Determining the first network address based on the first hash value;
Information processing system.
The first device comprises:
Sending the first public key to a certificate authority,
Obtaining a first digital certificate associated with the first public key from the certificate authority;
Transmitting the first digital certificate and the first public key to the second device,
The second device includes:
Transmitting the second public key to the certificate authority or another certificate authority,
Obtaining a second digital certificate associated with the second public key from the certificate authority or the another certificate authority,
Transmitting the second digital certificate and the second public key to the first device;
The first device comprises:
Receiving the second public key and the second digital certificate from the second device;
Determining whether the second digital certificate is valid,
The second device includes:
Receiving the first public key and the first digital certificate from the first device;
Determining whether the first digital certificate is valid,
An information processing system according to claim 25.